Unbound with HTTP/2 and QUIC for Comfast CF-WR632AX

Docker container for building Unbound with HTTP/2 and QUIC support for the Comfast CF-WR632AX, including all required dependencies.

Target

• Comfast CF-WR632AX
• OpenWrt 25.12.5
• MediaTek Filogic
• AArch64 / musl

Components

Requirements

• Docker (if you want to build with it)
• Disk space ~2 GB (~440 MB Image + ~1.5 GB Volume)

Result

• Fully statically linked Unbound executable
• HTTP/2 support
• DNS-over-QUIC support
• OpenSSL 3.5 provides the QUIC TLS API used by ngtcp2.

Steps

1. Install Docker (if you want to build with it and it is not already installed)
2. Install git (if not already installed)
3. Install Unbound on OpenWrt (if not already installed)

ssh root@192.168.1.1
apk add unbound-daemon
exit

4. Clone the repository

git clone https://github.com/nouai/unbound-builder.git
cd unbound-builder
chmod 777 output

5. Build

   5.A. Build the image and run the container (if you want to build with Docker. Otherwise, see 5.B)

   docker compose build
   docker compose up
   

   5.B. Build without Docker container (as super user)

   chown root:root ./build.sh
   chmod +x ./build.sh
   ./build.sh
   

6. Copy unbound-1.25.2-aarch64-static to the target device (Comfast CF-RW632AX)

scp -O output/unbound-1.25.2-aarch64-static root@192.168.1.1:/tmp/unbound-doh

7. SSH to the target device

ssh root@192.168.1.1

8. Prepare executable

cd /tmp
chown root:root unbound-doh
chmod +x unbound-doh

9. Update Unbound directory in unbound.conf

server:
    directory: "/etc/unbound"

10. Test Unbound with your config

/etc/init.d/unbound stop
./unbound-doh -c /etc/unbound/unbound.conf

11. Replace the Unbound executable

kill $(pgrep -f unbound-doh)
mv /tmp/unbound-doh /usr/sbin/unbound
/etc/init.d/unbound start